1. Field of the Invention
Embodiments of the invention relate to automated identification of operating systems run by nodes on a computer network.
2. Description of the Related Art
Computer networks, such as the Internet, Intranets, Local Area Networks (“LANs”), Wide Area Networks (“WANs”), and the like, often comprise a large number of network nodes running a variety of operating systems. “Network nodes,” or “nodes,” as used herein, are broad terms encompassing any electronic device that may be connected to a computer network such that it may receive data, transmit data, or both, over the computer network, and include, for example, desktop computers, laptop computers, server computers, client computers, routers, printers, and the like. These nodes typically execute operating systems, which, as used herein, is a broad term incorporating all operating systems as understood by a skilled artisan and including instructions in hardware, firmware, software, or any combination of the foregoing that control the basic operations of a node upon which the operating system executes.
A number of computer processes, including, for example, network vulnerability detection systems, include processes for identifying an operating system executed by the nodes of a computer network. Such processes for identifying operating systems typically rely on a test for detecting unique attributes of each operating system, such as, for example, a test that transmits certain Transmission Control Protocol (“TCP”) packets to a node and detects unique characteristics of TCP packets that the node transmits in response. Conventional operating system identification systems have a number of limitations, including, for example, employing invasive tests that may crash or otherwise harm a tested node, being limited to employing one or two identification tests in combination, and lacking a mechanism that resolves conflicts among competing identification tests. As such, conventional tests are limited in their safety and accuracy. It is anticipated that a skilled artisan will appreciate, in light of this disclosure, other limitations of conventional operating system identification systems.